CVE-2013-7137

moderate-risk
Published 2014-01-26

The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.

Do I need to act?

~
9.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
30916
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Burden

Affected Vendors

Burden Project

References (12)

Exploit http://www.exploit-db.com/exploits/30916
Broken Link http://www.securityfocus.com/archive/1/530703/100/0/threaded
Patch https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1
Issue Tracking https://github.com/joshf/Burden/issues/2
Release Notes https://github.com/joshf/Burden/releases/tag/1.8.1
Broken Link https://www.htbridge.com/advisory/HTB23192
Exploit http://www.exploit-db.com/exploits/30916
Broken Link http://www.securityfocus.com/archive/1/530703/100/0/threaded
Patch https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1
Issue Tracking https://github.com/joshf/Burden/issues/2
Release Notes https://github.com/joshf/Burden/releases/tag/1.8.1
Broken Link https://www.htbridge.com/advisory/HTB23192
48
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 11/34 · Low
Exposure 5/34 · Minimal